[mainlime]

I imagine it'll be done server side. The cookie will contain a hash value (a very long string of apparently random letters and numbers). The javascript on the web site will pass that hash back to Facebook with a request for an ad. Facebook match the hash to a user profile, pick an appropriate ad and send it back to the browser.

Cookies can't be read from the browser unless they are requested from the same domain that set them in the first place. And anyway without being able to query Facebook's backend database all you would get is a very long set of characters.